Put the type feedback vector in the unoptimized JavaScript frame.

src/ia32/deoptimizer-ia32.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #if V8_TARGET_ARCH_IA32
 
 #include "src/codegen.h"
 #include "src/deoptimizer.h"
@@ skipping 202 matching lines @@
 
 bool Deoptimizer::HasAlignmentPadding(JSFunction* function) {
   int parameter_count =
       function->shared()->internal_formal_parameter_count() + 1;
   unsigned input_frame_size = input_->GetFrameSize();
   unsigned alignment_state_offset =
       input_frame_size - parameter_count * kPointerSize -
       StandardFrameConstants::kFixedFrameSize -
       kPointerSize;
   DCHECK(JavaScriptFrameConstants::kDynamicAlignmentStateOffset ==
-      JavaScriptFrameConstants::kLocal0Offset);
+         JavaScriptFrameConstants::kFeedbackVectorOffset);
   int32_t alignment_state = input_->GetFrameSlot(alignment_state_offset);
   return (alignment_state == kAlignmentPaddingPushed);
 }
 
 
 #define __ masm()->
 
 void Deoptimizer::TableEntryGenerator::Generate() {
   GeneratePrologue();
 
@@ skipping 193 matching lines @@
   UNREACHABLE();
 }
 
 
 #undef __
 
 
 } }  // namespace v8::internal
 
 #endif  // V8_TARGET_ARCH_IA32